Summary:

https://github.com/CodeHawks-Contests/2025-02-vyper-vested-claims/blob/main/src/Token.vy#L38

def transferFrom(_from: address, _to: address, _value: uint256) -> bool:

self.allowance[_from][msg.sender] -= _value # Potential underflow

self._transfer(_from, _to, _value)

return True

Vulnerability Details:

There is no check to ensure _from has enough balance before subtracting

Impact:

Causes an underflow in Vyper, allowing transfers of more tokens than the _from address owns.

Tools Used: none

Recommendations:

Add a check:

assert self.allowance[_from][msg.sender] >= _value, "Allowance exceeded"